Data Protection Declaration

I. Introduction

At Pöschl Tabak GmbH & Co KG (“Pöschl”, “we” or “us”), protecting the privacy and confidentiality of the personal data (“data”) of visitors to our website www.poeschl-tobacco.com (“website”) and our customers and suppliers is of extreme importance. The following provisions describe how we treat visitors’ data, which we process in conjunction with the offer on our website, as well as the data of the contact persons from our customers and suppliers.

II. Controller and Data Protection Officer

This Privacy Policy applies to the data processing by the controller:

Pöschl Tabak GmbH & Co KG
Dieselstraße 1
84144 Geisenhausen
Tel.: +49 8743 971 – 0
Fax: +49 8743 – 110

poeschl@poeschl-tobacco.de

The operational Data Protection Officer can be contacted at:

Pöschl Tabak GmbH & Co KG
Dieselstraße 1
84144 Geisenhausen

datenschutz@poeschl-tobacco.de

III. General processing of personal data on our website

1. Accessing the website
a) When our website is accessed, the following information is recorded by our web server and stored in the server log files as standard:

• • the name of your internet service provider (ISP)
• • the website that you visited us from
• • the pages of our website that you visit
• • the amount of data transferred
• • the version of the http protocol used
• • files accessed
• • website browser type and version
• • internet protocol address (IP address)
• • date, time and duration of visit

b) The recording, storing and analysis of this data is for the purpose of provid-ing the website, for statistical purposes and to guarantee system security. This data is stored separately from all personal data. The data is not merged.

The collection of this data serves to protect our legitimate interests. The legal basis for the collection and processing of this data is Art. 6(1)(f) of the GDPR. You can request further information about the balancing of interests at any time from datenschutz@poeschl-tobacco.de.

c) The data is erased as soon as it is no longer required to fulfil the purpose for which it was collected.

In the case of the data stored in log files, this is at most 14 days after the re-spective session has ended. The data may be stored for longer in anony-mised format. In this case, the IP addresses will be deleted or distorted, so that they can no longer be associated with the retrieving client.

If the personal data is required to prosecute a crime, it will be deleted once the proceedings have been completed, taking legal retention periods into ac-count.

d) The provision of the data is stipulated neither by law nor by contract. The recording of the data to provide the website and the storage in log files is, however, required to operate the website.
Non-provision of personal data may lead to a disadvantage on your part. It may, for example, result in you not receiving or being able to utilise our ser-vices (e.g. it may not be possible to access the website). There won’t, howev-er, be any legal disadvantages to not providing this data, unless stated other-wise.

2. Use of our contact form
a) If you send us an enquiry via the contact form, the information that you provide on the enquiry form, including the contact details that you give, are saved for the purposes of processing the enquiry and in case there are fol-low-up questions. We will not pass on this data without your express permis-sion.

b) The processing of the data entered into the contact form is based on our legitimate interest in accordance with Art. 6(1)(f) of the GDPR, namely contact via a contact form. If the contact is for the purpose of concluding a contract, the processing is also based on the additional legal basis provided by Art. 6(1)(b) of the GDPR.

If your data is no longer required to process your request, your personal data will be deleted. This is generally at the end of our conversation with you, un-less we are obligated to store this data for longer periods in order to comply with our legal obligations.

c) The provision of personal data is stipulated neither by law nor by contract. However, we need this data to communicate with you. If you do not provide your data, we cannot have (or continue) a conversation with you.

IV. Cookies

Our website uses cookies. Cookies are text files which are deposited and stored on a computer system via a website browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It comprises a character string, which websites and servers use to allocate the concrete website browser in which the cookie has been stored. This allows the visited websites and servers to distinguish the individual browser of the data subject from other website browsers containing other cookies. A specific website browser can be recognised and identi-fied by the unique cookie ID.

1. We use the following types of cookies:
Cookies may be required to ensure that our website functions properly. By using cookies we can, for example, ascertain that you have registered on our website.

Cookies allow us to provide a more user-friendly website to you as a user of this website. This wouldn’t be possible without cookies.

The information and offers on our website can be optimised for the user with a cookie. As mentioned above, cookies allow us to recognise users returning to our website. The purpose of this recognition is to make it easier for users to use our website. The user of a website that utilises cookies does not, for example, need to re-enter their login details each time they visit the website, as this task is completed by the cookie that has been stored by the website on the user’s computer system.

Cookies can also be used to analyse website use. For example, to ascertain how many users visit the website and which parts of the website show room for improve-ment. There is no connection made between you the user and the statistics gener-ated using the data collected for this analysis. We will inform you where we use cookies for the purpose of website analysis.

2. Legal basis
When you visit our website, we ask for your consent, so that the saving of cookies is legitimate in accordance with Art. 6(1)(a) of the GDPR. The legal basis for the cookies that we need to provide the website is our legitimate interest in accordance with Art. 6(1)(f) of the GDPR. You can request further information about the balanc-ing of interests at any time from datenschutz@poeschl-tobacco.de.

3. Duration of use
We use the data collected by cookies for as long as it is required for the specified purpose. You can prevent the saving of cookies by our website at any time by changing the settings in your website browser and thus objecting to the saving of cookies over the long term. Furthermore, cookies that have already been saved can be deleted at any time using a website browser or other software program, or by using the opt-out links in the cookies table. This is possible in all standard website browsers. Deactivating cookies in the website browser or in the table may mean that certain functions of our website do not work properly.

4. Cookies used
The following table lists the types of cookies that we use for our website.

5. Use of Google Analytics
In order to optimise our website, to create a user-friendly website and to analyse your usage of the website, we use Google Analytics; a website analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google uses cookies that make it possible to analyse your use of our website. When you visit our website, you are informed about the use of cookies and requested to consent to this use via a cookie banner.
The information generated by the cookie about the use of this website by the user is generally transferred to a Google server in the USA and stored there. Prior to this data being transferred, the acquired information is anonymised, whereby the last 8 bits of your IP address are shortened by Google. Google is certified in line with the Privacy Shield agreement and thus guarantees to adhere to European data protection legislation (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Activey).

a) We share joint responsibility for the collection, storage and analysis of data used to optimise our website, Art. 26 GDPR. Google also processes this col-lated data for its own purposes. Google bears sole responsibility for this fur-ther processing. For more information on the handling of user data by Google Analytics, please see Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=de

b) We have activated the IP anonymisation function on this website. This causes your IP address to be shortened by Google within the member states of the European Union or in other contracting states of the convention about the European Economic Area before it is transferred to the USA. The full IP address will only be transferred to a Google server in the USA and shortened there in exceptional cases. Google uses this information on behalf of the op-erator of this website to analyse your use of the website, to compile reports about the website activities, and to provide further services related to the use of the website and the internet in general. The IP address transferred from your browser as part of Google Analytics will not be merged with other data from Google.

c) The following data is collected when you visit our website:

• • The pages you visit – your “click path”
• • Whether certain “website goals” (conversions, e.g. newsletter subscriptions, downloads, purchases) are reached
• • Your user behaviour (e.g. clicks, amount of time spent on a page, bounce rate)
• • Your approximate location (region)
• • Your IP address (shortened)
• • Technical information about your browser and your device (e.g. language setting, screen resolution)
• • Your internet service provider
• • Your referral URL (the website/ad that sent you to this website)

d) You can prevent the saving of cookies through a setting on your web browser software. However, we would like to point out that if you turn off cookies, you will not be able to use all of the functions of this website to their full extent.

e) The use of Google Analytics is based purely on your consent; Art. 6(1)(a) of the GDPR. You can prevent the collection of your data by Google Analytics by clicking on the following link. This will save an opt-out cookie on your browser, which will prevent your data being collected on future visits to this website:
https://tools.google.com/dlpage/gaoptout?hl=de.

F) This website utilises so-called demographics information from Google Ana-lytics. This makes it possible to create reports containing statements about the age, gender and interests of website users. This data is collated from interest-based advertising by Google and from visitor data from third parties. This data cannot be associated with a specific person. You can deactivate this function at any time using the display settings in your Google account, or can prevent the collection of any of your data by Google Analytics by following the instruc-tions provided in the section entitled “Objecting to data collection”.

V. Links to other websites

Our website contains links to other websites.

The operators of the linked websites are solely responsible for their data protection principles and their content. We recommend that you check this carefully when visiting linked websites.

VI. Processing the personal data of applicants

1. Applying to Pöschl
We process the personal data of applicants during our application process. This includes all of the information that applicants provide us with as part of their applica-tion (e.g. contact details, CV, qualifications, cover letter). We do not plan to process special categories of personal data. If applicants provide this data, our data pro-cessing also includes this data.

2. Being admitted into the pool of candidates
If applicants want to be admitted into the pool of candidates, we save the following personal data, so that we can inform applicants of future applications that may be relevant to them. Applicants have generally shared this information with us already as part of their application:

• • your CV
• • your address
• • your notice period
• • your desired salary
• • your reason for applying
• • the position you wish to apply for
• • whether you are mobile
• • when you were added to the pool of candidates
• • which departments are relevant for you
• • your professional grade/level of management

3. Purpose and legal basis for the data processing
The processing of applicants’ personal data is for the purpose of carrying out an application procedure. This personal data is solely processed for this purpose. The legal basis of this data processing is Section 26(1) of the BDSG (German Federal Data Protection Act) and Art. 88 of the GDPR.

Insofar as applicants consent, we also process personal data to add the applicants to a pool of candidates. This is so that applicants can be considered in other applica-tions and contacted in the case of suitable vacancies. This data processing only takes place where the express consent of the applicant has been provided, in accordance with Art. 6(1)(a) of the GDPR.

4. Retention period
We delete the personal data that applicants provide us with within six months of rejecting the application at the latest, or when the applicant revokes their consent to being included in the pool of candidates.

5. Recipients of applicant data
The personal data that we receive from the applications is saved by our external service provider D.Vinci Bewerbermanagement (“D. Vinci”) for the purpose of carrying out the application process and contacting you to establish an employment relationship. As our contractor, D. Vinci is subject to our instructions. We have concluded a data processing agreement with D. Vinci. This service provider is subject to our instructions as well as strict contractual restrictions concerning data processing. Data processing is only permitted where it is necessary to carry out the services in our name or to adhere to statutory requirements. We precisely specify the rights and obligations that our service provider has concerning personal data in advance.

Apart from that, we only share applicant data with third parties when we are legally required to do so.

6. Consequences of non-provision
The provision of personal data is necessary in order to carry out the application procedure or to conclude an employment contract with applicants. Applicants are not obligated to provide Pöschl with their personal data. Should applicants not provide Pöschl with the personal data that is required to carry out the application process, Pöschl may not be able to include these applicants in the application process.

The provision or non-provision of consent for admission to the pool of candidates does not impact the chances of success for a job application to Pöschl.

VII. Security

We employ technical and organisational measures to protect the data that you provide us with from accidental or deliberate manipulation, loss, destruction or from access by unauthorised persons. Our security measures are constantly being improved in line with the latest technological developments.

VIII. Contractors and sharing with third parties

We only pass your data onto service providers or third parties in accordance with the applicable data protection legislation.

1. Contractors
We disclose personal data to the service provider that we commission and obligate this service provider to perform services in our name. This is particularly relevant to the processing of your personal data for website maintenance and hosting. We adhere to the strict national and European data protection regulations. The IT service provider based in Germany operates this website and hosts it externally for us. This service provider is subject to our instructions as well as strict contractual restrictions concerning the processing of personal data. Data processing is only permitted where it is necessary for the maintenance of the website and hosting or to adhere to statutory requirements. We precisely specify the rights and obligations that our IT service provider has concerning personal data in advance. This service provider stores and processes all personal data on servers in Germany and deletes this data in accordance with the statutory retention periods and our instructions.

2. Third parties
In addition, we and our service providers only share your personal data:

• • if we are legally or judicially obligated to do so
• • to law enforcement agencies or other state authorities
• • where we accept that the disclosure is necessary or appropriate to prevent physical damages or financial losses, or in conjunction with an investiga-tion into alleged or actual fraudulent or illegal activities

Should we or our assets be partially or fully sold, conferred or restructured, we also reserve the right to share data that we own that relates to you. Should a sale or transfer of this kind occur during the application process, we will make appropriate efforts to impel the receiver to utilise this personal data in a way that is in keeping with our data protection regulations. Following a sale or transfer of this kind, you can consult the relevant person who is responsible for the processing of your data for any questions concerning the processing of this data.

IX. Rights of the data subject

As a data subject as described in the GDPR, you have the following rights:

• • information, correction, erasure, restriction and data portability
• • right to object
• • withdrawal of consent
• • complaint to a supervisory authority

1. Information, correction, erasure, restriction and data portability
a) You have the right to receive information about the personal data that we hold about you (Art. 15 of the GDPR). This right to information also includes the right to receive a copy of the data that is the object of the processing. We will provide this copy of the data free of charge. Pöschl is permitted to de-mand an appropriate fee based on administration costs for any additional copies requested by the data subject.

b) You have the right to rectification (Art. 16 of the GDPR) of the personal da-ta that we hold about you, insofar as this data is incorrect.

c) You have the right to erasure (Art. 17 of the GDPR) and/or restriction of processing of your personal data (Art. 18 of the GDPR). If you request the erasure of your data, we are obligated to delete your data without delay. This does not apply where one of the legal exceptions listed in Art. 17 of the GDPR applies.

d) Furthermore, you are entitled to practise your right to data portability (Art. 20 of the GDPR).

2. Right to object
According to Art. 21 of the GDPR, you have the right to object to the processing of your personal data that has been collected in accordance with Art. 6(1)(e) or (f) of the GDPR at any time. Insofar as we are not legally obligated or authorised to continue to process your personal data, we will no longer process your personal data in this case. This also applies to profiling based on these provisions.
If you object to the use of your data for direct marketing, we will no longer process your personal data for these purposes (Art. 21(2) of the GDPR).

3. Right to revoke consent
You have the right to revoke consent that you have previously given at any time. Revoking consent does not affect the legality of the processing that occurred prior to consent being withdrawn (Art. 7(3) of the GDPR).

4. Complaint to a supervisory authority
Notwithstanding any other administrative or judicial remedies, you have the right to complain to a supervisory authority, if you believe that the processing of your personal data by us breaches the stipulations of the GDPR.

X. Topicality and changes to this Privacy Policy

This Privacy Policy is currently valid and was created in November 2020.